Ashish Kunwar

An integer underflow occurs due to insufficient input validation. An attacker who controls a network file server can exploit this to cause unexpected system termination.

A cross-site WebSocket hijacking protection bypass occurs when self-signed certificates are used. This is caused by an unconditional early return in the `CheckWebServerOriginName()` function within `webserver.js`. Unauthenticated remote attackers can establish cross-origin WebSocket connections to any of the twelve WebSocket endpoints and send crafted action commands to exfiltrate the server `sessionKey` used to sign session cookies. This allows attackers to forge session tokens as arbitrary users and gain full remote control of all managed devices.

A path traversal flaw exists in spice-vdagent, where a path traversal is a vulnerability that allows an attacker to access files and directories that are stored outside the web root folder. This issue occurs because the filename provided by the SPICE host during file transfers is not properly sanitized. Consequently, a malicious or compromised SPICE host can write arbitrary files to any location on the guest operating system using the privileges of the spice-vdagent process, which typically corresponds to the logged-in user.

A flaw exists where a malicious or compromised SPICE host can trigger an integer overflow by sending a specially crafted message. This leads to a heap buffer overflow within the `udscs write()` function, causing the spice-vdagent daemon to crash and resulting in a Denial of Service (DoS) for the virtual machine. Exploitation requires the SPICE host to be untrusted or compromised.

A heap-based buffer overflow exists in the FTS5 full-text search extension. An attacker can cause a crash or execute arbitrary code by providing a crafted database containing malicious continuation page metadata with a `szLeaf` value smaller than 4. This triggers an integer underflow in the `fts5ChunkIterate()` function, resulting in an inflated remaining byte count during FTS5 MATCH query processing. This issue affects applications compiled with `SQLITE ENABLE FTS5`.

Memory corruption issues exist in the FTS5 full-text search extension. An attacker can cause process crashes, memory exhaustion, or arbitrary code execution by providing a crafted database containing malformed FTS5 page data. This is exploitable when an FTS5 MATCH query is executed against the malicious database. Technical details include an out-of-bounds read in the `fts5LeafSeek()` function via an attacker-controlled loop bound, and a heap buffer overflow write in the `fts5ChunkIterate()` function caused by an integer underflow through a crafted continuation page.

A use-after-free race condition exists in the IOKit framework, specifically within the IOTimeSyncFamily kernel extension and the `IOTimeSyncClockManager` component. A use-after-free is a memory corruption issue that occurs when an application continues to use a pointer after the memory it points to has been freed. This flaw may allow an app to cause unexpected system termination.

The issue is related to errors in the representation of information by the user interface, allowing a remote attacker to conduct spoofing attacks. This can affect the system, enabling attackers to exploit the vulnerability.